A bank's AI model governance policy requires all high-risk models to undergo independent validation before production deployment. An internal validation team reports that the fraud detection model passes performance benchmarks. However, the team that built the model also performs ongoing monitoring. Which governance gap does this reveal?

B is correct because SR 11-7 explicitly requires that model validation be conducted by staff independent of model development AND that ongoing performance monitoring also maintain independence from the model builders. When the same team builds and monitors a model, they have an inherent conflict of interest that undermines the control. A may be a separate gap but is not what is described. C is not required; internal validation is acceptable if properly independent. D is a risk avoidance strategy that would not resolve the independence problem.